Analysis
-
max time kernel
899s -
max time network
897s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2022 04:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ntintegratedtherapycomau-my.sharepoint.com/:f:/g/personal/camilla_ntintegratedtherapy_com_au/ErItCTzuCm5Gte3g8pH5Y2UBTfMMS_dSAjP8_DqvaWx5_g?e=FeZT3E
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
https://ntintegratedtherapycomau-my.sharepoint.com/:f:/g/personal/camilla_ntintegratedtherapy_com_au/ErItCTzuCm5Gte3g8pH5Y2UBTfMMS_dSAjP8_DqvaWx5_g?e=FeZT3E
Resource
win10v2004-20221111-en
General
-
Target
https://ntintegratedtherapycomau-my.sharepoint.com/:f:/g/personal/camilla_ntintegratedtherapy_com_au/ErItCTzuCm5Gte3g8pH5Y2UBTfMMS_dSAjP8_DqvaWx5_g?e=FeZT3E
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ChromeRecovery.exepid process 4344 ChromeRecovery.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 9 IoCs
Processes:
elevation_service.exesetup.exedescription ioc process File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2716_960800037\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2716_960800037\ChromeRecovery.exe elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2716_960800037\manifest.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2716_960800037\manifest.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2716_960800037\_metadata\verified_contents.json elevation_service.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\de66a435-7dee-430e-8c80-ae0986d0f769.tmp setup.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2716_960800037\ChromeRecoveryCRX.crx elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2716_960800037\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221122053547.pma setup.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
msedge.exechrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies registry class 2 IoCs
Processes:
firefox.exemsedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 428 chrome.exe 428 chrome.exe 4036 chrome.exe 4036 chrome.exe 4564 chrome.exe 4564 chrome.exe 4940 chrome.exe 4940 chrome.exe 364 chrome.exe 364 chrome.exe 980 chrome.exe 980 chrome.exe 980 chrome.exe 980 chrome.exe 4608 chrome.exe 4608 chrome.exe 4228 chrome.exe 4228 chrome.exe 4504 chrome.exe 4504 chrome.exe 2416 msedge.exe 2416 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 5272 identity_helper.exe 5272 identity_helper.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
Processes:
chrome.exemsedge.exepid process 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 4588 firefox.exe Token: SeDebugPrivilege 4588 firefox.exe Token: SeDebugPrivilege 4588 firefox.exe Token: SeDebugPrivilege 4588 firefox.exe Token: SeDebugPrivilege 4588 firefox.exe Token: SeDebugPrivilege 4588 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exefirefox.exemsedge.exepid process 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4588 firefox.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe -
Suspicious use of SendNotifyMessage 59 IoCs
Processes:
chrome.exefirefox.exemsedge.exepid process 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
firefox.exepid process 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe 4588 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4036 wrote to memory of 4440 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4440 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 4528 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 428 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 428 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe PID 4036 wrote to memory of 3728 4036 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://ntintegratedtherapycomau-my.sharepoint.com/:f:/g/personal/camilla_ntintegratedtherapy_com_au/ErItCTzuCm5Gte3g8pH5Y2UBTfMMS_dSAjP8_DqvaWx5_g?e=FeZT3E1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6f994f50,0x7ffb6f994f60,0x7ffb6f994f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1712 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2032 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2276 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5316 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1560 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4684 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5280 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3580 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5320 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5436 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2352 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=908 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5516 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3560 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5348 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5408 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4572 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4544 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3164 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5712 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5608 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,9277529339147119979,6495338730649579620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5964 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2716_960800037\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2716_960800037\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={06696401-855e-4734-8799-ad1b83d09de2} --system2⤵
- Executes dropped EXE
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4588.0.1204399881\922983638" -parentBuildID 20200403170909 -prefsHandle 1684 -prefMapHandle 1676 -prefsLen 1 -prefMapSize 219944 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4588 "\\.\pipe\gecko-crash-server-pipe.4588" 1764 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4588.3.790816121\2146631719" -childID 1 -isForBrowser -prefsHandle 2476 -prefMapHandle 1552 -prefsLen 78 -prefMapSize 219944 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4588 "\\.\pipe\gecko-crash-server-pipe.4588" 2488 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4588.13.2036945393\1948156250" -childID 2 -isForBrowser -prefsHandle 3788 -prefMapHandle 3784 -prefsLen 6860 -prefMapSize 219944 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4588 "\\.\pipe\gecko-crash-server-pipe.4588" 3776 tab3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb702b46f8,0x7ffb702b4708,0x7ffb702b47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5192 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5524 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff77a2f5460,0x7ff77a2f5470,0x7ff77a2f54803⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3164 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5128 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5096 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5396 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7120 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6512 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1384 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,12772435742297736842,14577879751281597784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5268 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2716_960800037\ChromeRecovery.exeFilesize
253KB
MD549ac3c96d270702a27b4895e4ce1f42a
SHA155b90405f1e1b72143c64113e8bc65608dd3fd76
SHA25682aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f
SHA512b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEFilesize
471B
MD58547b9a5c63a368f42299481655b2edb
SHA141403b04b68e6d1a77141863fff52957f1a0b4f6
SHA256dfa88bfbdb56634f2d39b985689804955454a21ce1cbbb59a914546e433fd907
SHA512ba94c0e67251601d57409e59aa263d1fa1f5582cca870d3626f43b3cef5e5b255592a12712deb148db528ed0ecd3c643f1efddc1f5d4df995402e6575fdf2a29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEFilesize
446B
MD577cfee4849bc4065532629df7f6cf801
SHA15b782f62cd23570c1b92472c64618bafbf724400
SHA2564f018af1f72fb017a6ae87d084671c7bfa6d35c15da2bd292932ef95f23ec9f7
SHA512be52269ffb002181fdb826eac0f19796d7475b13b21b93ffe73076990baa6d3ce2b85e57677fecb42ee239241650a62e6ebbd701399ef261b5938068f1586753
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
209KB
MD5bb4a70f16303d615e11654596685d479
SHA14035f31ab221ee870fa5408a2fa1275d32f02605
SHA256f783c62c1e6f03c76ba94ac7bac1c35cabd2694e10cd323f4e6fc7adb7731ebb
SHA5121bef24c825edc0afe1b7e3ab0ea7abee6d6cf30f158066809fe57bea5c4cf2af8831daf626b7e1ba07c958ad127cff19dea470547159f7e34ca6b34b20e0707d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3Filesize
141KB
MD5ea1c1ffd3ea54d1fb117bfdbb3569c60
SHA110958b0f690ae8f5240e1528b1ccffff28a33272
SHA2567c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d
SHA5126c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Mu\AdvertisingFilesize
24KB
MD54e9962558e74db5038d8073a5b3431aa
SHA13cd097d9dd4b16a69efbb0fd1efe862867822146
SHA2566f81212bd841eca89aa6f291818b4ad2582d7cdb4e488adea98261494bdcd279
SHA512fcd76bca998afc517c87de0db6ee54e45aa2263fa7b91653ac3adb34c41f3681fbe19d673ae9b24fdf3d53f5af4e4968e603a1eb557207f8860ac51372026b2e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_2248_MZMITGWOFLRURWIEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_4036_GZFETDXBUNKPGUUIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1508-167-0x0000000000000000-mapping.dmp
-
memory/1544-139-0x0000000000000000-mapping.dmp
-
memory/2156-137-0x0000000000000000-mapping.dmp
-
memory/2416-140-0x0000000000000000-mapping.dmp
-
memory/3052-180-0x0000000000000000-mapping.dmp
-
memory/3168-176-0x0000000000000000-mapping.dmp
-
memory/4344-135-0x0000000000000000-mapping.dmp
-
memory/4520-165-0x0000000000000000-mapping.dmp
-
memory/4792-186-0x0000000000000000-mapping.dmp
-
memory/5208-143-0x0000000000000000-mapping.dmp
-
memory/5272-157-0x0000000000000000-mapping.dmp
-
memory/5280-173-0x0000000000000000-mapping.dmp
-
memory/5292-159-0x0000000000000000-mapping.dmp
-
memory/5312-175-0x0000000000000000-mapping.dmp
-
memory/5404-146-0x0000000000000000-mapping.dmp
-
memory/5440-148-0x0000000000000000-mapping.dmp
-
memory/5464-150-0x0000000000000000-mapping.dmp
-
memory/5532-169-0x0000000000000000-mapping.dmp
-
memory/5648-163-0x0000000000000000-mapping.dmp
-
memory/5656-171-0x0000000000000000-mapping.dmp
-
memory/5756-152-0x0000000000000000-mapping.dmp
-
memory/5760-178-0x0000000000000000-mapping.dmp
-
memory/5836-184-0x0000000000000000-mapping.dmp
-
memory/5876-161-0x0000000000000000-mapping.dmp
-
memory/5964-154-0x0000000000000000-mapping.dmp
-
memory/6036-155-0x0000000000000000-mapping.dmp
-
memory/6124-156-0x0000000000000000-mapping.dmp